agenttesla | 2907a1c2f6d6f17d63b878f0bcf00360d68ebe320aa90cfa0c829fe7f6747250

Analysis

max time kernel
98s
max time network
75s
platform
windows10_x64
resource
win10v20210408
submitted
02/06/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT Consignment Detail_pdf.exe
Size 269KB
Sample210602-56bt5shlb2
SHA256 2907a1c2f6d6f17d63b878f0bcf00360d68ebe320aa90cfa0c829fe7f6747250
MD5 f39fc76d169d405230915b3551e9bcf0
SHA1 770f565d290a947d358c182ff7358088df230025
SHA512 93cda0f58c655a59626d9ce8fda274a8a55fedd005aebe632c1a53b04c2e75fd3993bb03ddcb82324e73c25723779a6590dd516b8dbaae5dfcba32b698baf1fe
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
gmicaprelam.in
Port
587
Username
[email protected]
Password
chybke2424@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3036-117-0x0000000000620000-0x000000000065C000-memory.dmp	family_agenttesla
behavioral2/memory/3036-121-0x0000000004A80000-0x0000000004F7E000-memory.dmp	family_agenttesla

Loads dropped DLL 2 IoCs

pid	Process
916	TNT Consignment Detail_pdf.exe
916	TNT Consignment Detail_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 3036	916	TNT Consignment Detail_pdf.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	MSBuild.exe
3036	MSBuild.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
916	TNT Consignment Detail_pdf.exe
916	TNT Consignment Detail_pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3036	916	TNT Consignment Detail_pdf.exe	74
PID 916 wrote to memory of 3036	916	TNT Consignment Detail_pdf.exe	74
PID 916 wrote to memory of 3036	916	TNT Consignment Detail_pdf.exe	74
PID 916 wrote to memory of 3036	916	TNT Consignment Detail_pdf.exe	74

C:\Users\Admin\AppData\Local\Temp\TNT Consignment Detail_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Consignment Detail_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\TNT Consignment Detail_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-117-0x0000000000620000-0x000000000065C000-memory.dmp

Download

memory/3036-119-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/3036-120-0x0000000004C60000-0x0000000004C61000-memory.dmp

Download

memory/3036-121-0x0000000004A80000-0x0000000004F7E000-memory.dmp

Download

memory/3036-122-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/3036-123-0x0000000005870000-0x0000000005871000-memory.dmp

Download

memory/3036-124-0x0000000005D40000-0x0000000005D41000-memory.dmp

Download

memory/3036-125-0x0000000000990000-0x0000000000991000-memory.dmp

Download